Unsafe symlink following in restricted workspace-write sandbox leads to RCE

Codex CLI in workspace-write mode follows symbolic links without proper validation, allowing an attacker to overwrite arbitrary files on the system. If a malicious repository or directory tricks the tool into following a symlink, attackers can execute code with the privileges of the user running Codex.

A symlink-following vulnerability exists in Codex CLI's workspace-write sandbox where malicious symlinks within a repository or working directory are traversed without validation, bypassing directory restrictions. Pre-condition: user executes Codex CLI in workspace-write mode within attacker-controlled directory context. Impact: arbitrary file overwrite and potential RCE via code execution through modified files.